1 # SPDX-License-Identifier: GPL-2.0-only
2 config SECURITY_SELINUX
3 bool "SELinux Support"
4 depends on SECURITY_NETWORK && AUDIT &
5 select NETWORK_SECMARK
6 default n
7 help
8 This selects Security-Enhanced Linux
9 You will also need a policy configur
10 If you are unsure how to answer this
11
12 config SECURITY_SELINUX_BOOTPARAM
13 bool "SELinux boot parameter"
14 depends on SECURITY_SELINUX
15 default n
16 help
17 This option adds a kernel parameter
18 to be disabled at boot. If this opt
19 functionality can be disabled with s
20 command line. The purpose of this o
21 kernel image to be distributed with
22 necessarily enabled.
23
24 If you are unsure how to answer this
25
26 config SECURITY_SELINUX_DEVELOP
27 bool "SELinux Development Support"
28 depends on SECURITY_SELINUX
29 default y
30 help
31 This enables the development support
32 which is useful for experimenting wi
33 policies. If unsure, say Y. With t
34 kernel will start in permissive mode
35 unless you specify enforcing=1 on th
36 can interactively toggle the kernel
37 permissive mode (if permitted by the
38 /sys/fs/selinux/enforce.
39
40 config SECURITY_SELINUX_AVC_STATS
41 bool "SELinux AVC Statistics"
42 depends on SECURITY_SELINUX
43 default y
44 help
45 This option collects access vector c
46 /sys/fs/selinux/avc/cache_stats, whi
47 tools such as avcstat.
48
49 config SECURITY_SELINUX_SIDTAB_HASH_BITS
50 int "SELinux sidtab hashtable size"
51 depends on SECURITY_SELINUX
52 range 8 13
53 default 9
54 help
55 This option sets the number of bucke
56 to 2^SECURITY_SELINUX_SIDTAB_HASH_BI
57 collisions may be viewed at /sys/fs/
58 chain lengths are high (e.g. > 20) t
59 will ensure that lookups times are s
60
61 config SECURITY_SELINUX_SID2STR_CACHE_SIZE
62 int "SELinux SID to context string tra
63 depends on SECURITY_SELINUX
64 default 256
65 help
66 This option defines the size of the
67 cache, which improves the performanc
68 conversion. Setting this option to
69
70 If unsure, keep the default value.
71
72 config SECURITY_SELINUX_DEBUG
73 bool "SELinux kernel debugging support
74 depends on SECURITY_SELINUX
75 default n
76 help
77 This enables debugging code designed
78 developers, unless you know what thi
79 should leave this disabled.
80
81 To fine control the messages to be p
82 CONFIG_DYNAMIC_DEBUG and see
83 Documentation/admin-guide/dynamic-de
84 information.
85
86 Example usage:
87
88 echo -n 'file "security/selinu
89 /proc/dynamic_debug/co
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.